jwt_get_secret_key check if user exists

[ghost]

When a user with a deleted account tries to access the website with a JWT that is still valid, it causes an error 500. This checks if the user with the given pk exists, and if not, it will return the api_settings.JWT_SECRET_KEY instead of the deleted user's secret key

[lahim]

jwt.InvalidTokenError() exception should be raised, for sure there is not place for pass statement. Please take a look into the BaseJSONWebTokenAuthentication class where InvalidTokenError exception is handled.

[lahim]

This code should be outside of this try ... except block. So it should look like below:

try:
    user = User.objects.get(pk=payload.get('user_id'))
except User.DoesNotExist:
    raise jwt.InvalidTokenError()
else:
    return str(api_settings.JWT_GET_USER_SECRET_KEY(user))

[detectedstealth]

Any ETA on when this will be merged? I ran into the same issue with a deleted user.